Hi All, we upgraded our Splunk Enterprise to the latest 9.0.2 and noticed something odd in the About page. Why does the products say "Retention" ?  What does it mean?  Have never come across like this before     ... View more

Hi All,  Before i post here i have tried everything under https://community.splunk.com/t5/Splunk-Search/How-to-join-2-indexes/m-p/560334  but couldnt figure out my search.  Index01 contains  fields of interest as follows :  host, hostname, agent_version,agent_date The difference between host & hostname fields is host contains  name of HF server (which i dont want to correlate)  while hostname contains the list of device names  (which i want to correlate with Index02).  In Index02., the fields of interest are:  host (default field), _time (default field)  To summarize, the field hostname from Index01 matches the values of the field host from Index02 . So this is the common denominator. Requirement is for all the devices from index01,  find  out the latest time stamp (as in when the device last logged) from Index02.    Below is what i need to achieve: hostname(Index01) agent_date (Index01) agent_version (Index01) LastSeen (Index02) xxx xxx xxx xxxx         Have tried below 2 queries but no luck.   It shows 0 results found.  But if i run the search individually they show data.     index=index01 | rex field=dns "(?P<hostname>[a-zA-Z0-9-]+)." | dedup hostname [ search index=Index02 | stats latest(_time) as lastSeen_epoch BY host | eval LastSeen=strftime(lastSeen_epoch,"%m/%d/%y %H:%M:%S") | fields host LastSeen ] | table hostname agent_date agent_version LastSeen OR index=index01 [ search index=Index02 | stats latest(_time) as lastSeen_epoch BY host | eval LastSeen=strftime(lastSeen_epoch,"%m/%d/%y %H:%M:%S") | fields host LastSeen ] | rex field=dns "(?P<hostname>[a-zA-Z0-9-]+)." | dedup hostname | table hostname agent_date agent_version LastSeen           ... View more